Privacy

What stays on your device

Your schedule, diary entries and ratings, your ranking, and your Wrapped are stored on the device you are using. While you are signed out that is the only copy — there is nothing for us to read. Delete the app and that data goes with it.

What the app sends us

Signed out, the app sends us two things: the notification address described under Notifications below, if you turn award alerts on, and what you post to the shared rush board, only when you tap to post it:

• the screening you are lining up for and how many people you counted;
• whether you got in, when you report the outcome afterwards;
• your location at that moment, if you allow it — so your count appears in the right place on the line map. The app asks for location only while you are using it, never in the background, and never when you are not posting a count.

Rush posts made while signed out are anonymous. We store a one-way hash of your IP address alongside them so one person cannot flood a line with fake counts. The hash cannot be turned back into an address, it is never shown to anyone, and it is not used to build a profile of you. Posts drop off the line map after twelve hours.

Photos

The app asks for permission to add to your photo library only when you save a story image or your Wrapped video. It never reads your library.

Notifications

Notifications are off until you turn them on in Settings, and iOS asks your permission first. Reminders for screenings you planned, rush lines forming and festivals opening are scheduled on your phone from your own schedule; nothing about them is sent to us.

Award alerts have to come from us, because nobody’s phone knows when a prize is announced. For those, the app sends us the push address Apple gives your device, and we store it with nothing else: no name, no account, no location. We use it only to send award alerts, through Apple’s push service. Turn award alerts off and the app deletes the address from our servers there and then. Delete the app and Apple stops delivering to it, and we remove it once Apple tells us it is no longer valid.

What we never collect

There is no analytics SDK, no advertising SDK, no crash reporter, and no third-party tracker in the app. We do not sell or share data with anyone, we do not track you across other apps or websites, and there is no advertising identifier in the build.

If you sign in

Signing in syncs your diary, schedule, ranking and votes across your devices, and that needs an account. It is optional, and everything else works without one. In the iOS app you can sign in with Apple or Google; on the website, with Google, Apple or Reddit. It is the same account either way, so what you save on your phone is there on the web.

When you sign in, we store:

• the name, email address and profile picture your sign-in provider gives us;
• the festival data you save while signed in: diary entries and ratings, your schedule, your ranking, and your votes;
• rush-line counts and outcomes you post while signed in, which are linked to your account rather than anonymous.

We use this only to sign you in, show your name and picture on your account, and keep your festival data in sync. It is stored with Supabase, our hosting provider for accounts and data. We never see your password. We do not sell it, use it for advertising, or share it with anyone else.

Google user data

If you sign in with Google, FilmFest asks Google only for your basic profile: your name, email address and profile picture (the openid, email and profile scopes). We do not request access to your Gmail, Drive, Calendar, contacts or any other Google data.

• How we use it: to create and sign in to your FilmFest account, and to show your name and picture on it. Nothing else.
• How we store it: in our Supabase database, encrypted in transit and at rest, alongside your festival data.
• Sharing: we do not share, transfer or sell Google user data to anyone, and we do not use it for advertising or to train AI or machine-learning models.
• Deleting it:delete your account from the app or the website and everything stored with it goes at once, including the data Google gave us. You can also remove FilmFest’s access at any time from your Google Account under Security → Third-party apps & services.

FilmFest’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sign in with Apple

If you sign in with Apple, we receive your name and an email address, which may be a private relay address if you choose Hide My Email. We use and store it exactly as described above.

Deleting your data

If you have an account you can close it yourself, and it goes immediately: in the app, Settings → Account → Delete account; on the website, the avatar in the top bar → Delete account. Your diary, schedule, ranking and votes are deleted with it, and nothing is kept in a backup for later. Rush counts and outcomes you posted while signed in stay on the board, because other people are still reading them, but they are detached from your account and nobody is attached to them any more. Counts posted while signed out were never linked to you.

Children

FilmFest is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes we will update this page and the date below. Last updated 25 September 2026.

Contact

Questions about any of this: hello@filmfestapp.com.

FilmFest is an independent app. It is not affiliated with, authorised by, or endorsed by any festival it lists, including the Toronto International Film Festival Inc.